Security Finding in ABP v9.2.4: Dynamic LINQ Expression Injection via Paged List Endpoints (?sorting=) #10728

1 Answer(s)

• 

  0

  maliming created 3 months ago

  Support Team Fullstack Developer

  Hi,

  Confirmed — the ?sorting= query parameter on every list endpoint that consumes ISortedResultRequest flows straight into IQueryable.OrderBy(string) from System.Linq.Dynamic.Core. The library's RestrictOrderByToPropertyOrField default in 1.6.0+ only blocks top-level keywords like IIF(...) and Substring(x, ...); it does not block method calls on a property (PasswordHash.Substring(0, 1)), comparison expressions (PasswordHash > "X") or chained predicates. EF Core translates those into real ORDER BY SUBSTRING(...) / CASE WHEN ... THEN 1 ELSE 0 END SQL, so an authenticated user with list access can byte-extract sensitive columns through the row ordering, even when those columns are never in the response DTO.

  The fix has to sit outside Dynamic.Core. ExtensibilityPoint.QueryOptimizer is the public static hook the library exposes for inspecting expanded query trees; it fires on every OrderBy(string) and ThenBy(string) call regardless of which layer the caller sits in (MVC, Blazor, background job, direct DI call), so a single registration covers all of your list endpoints at once.

  Drop this class into your *.HttpApi.Host (any host that boots AbpDddApplicationModule works — adjust the namespace to fit your project):

  using System;
  using System.Linq;
  using System.Linq.Dynamic.Core;
  using System.Linq.Expressions;
  using Volo.Abp.Validation;
  
  namespace MyCompanyName.MyProjectName;
  
  public static class DynamicSortingGuard
  {
      private static readonly object InstallLock = new();
      private static Func<Expression, Expression> _activeOptimizer;
  
      public static void Install()
      {
          lock (InstallLock)
          {
              var current = ExtensibilityPoint.QueryOptimizer;
              if (_activeOptimizer != null && ReferenceEquals(current, _activeOptimizer))
              {
                  return;
              }
  
              var previous = current;
              _activeOptimizer = expression =>
              {
                  new OrderByMethodVisitor().Visit(expression);
                  return previous != null ? previous(expression) : expression;
              };
              ExtensibilityPoint.QueryOptimizer = _activeOptimizer;
          }
      }
  
      private sealed class OrderByMethodVisitor : ExpressionVisitor
      {
          protected override Expression VisitMethodCall(MethodCallExpression node)
          {
              if (node.Method.DeclaringType == typeof(Queryable) &&
                  IsOrderByMethod(node.Method.Name) &&
                  node.Arguments.Count >= 2 &&
                  node.Arguments[1] is UnaryExpression { Operand: LambdaExpression lambda })
              {
                  new PropertyOnlySelectorVisitor().Visit(lambda.Body);
              }
  
              return base.VisitMethodCall(node);
          }
  
          private static bool IsOrderByMethod(string name)
          {
              return name == nameof(Queryable.OrderBy)
                  || name == nameof(Queryable.OrderByDescending)
                  || name == nameof(Queryable.ThenBy)
                  || name == nameof(Queryable.ThenByDescending);
          }
      }
  
      private sealed class PropertyOnlySelectorVisitor : ExpressionVisitor
      {
          private const string Message = "Sorting expression is not supported.";
  
          protected override Expression VisitMethodCall(MethodCallExpression node)
              => throw new AbpValidationException(Message);
  
          protected override Expression VisitBinary(BinaryExpression node)
              => throw new AbpValidationException(Message);
  
          protected override Expression VisitConditional(ConditionalExpression node)
              => throw new AbpValidationException(Message);
  
          protected override Expression VisitConstant(ConstantExpression node)
              => throw new AbpValidationException(Message);
      }
  }
  

  Then call it once from your host module:

  public override void PreConfigureServices(ServiceConfigurationContext context)
  {
      DynamicSortingGuard.Install();
  }
  

  That's the whole change. After deploying:

  • ?sorting=Name desc and any other plain property path (including nested ones like Tenant.Name) keep working
  • ?sorting=PasswordHash.Substring(0, 1) desc, ..., ?sorting=PasswordHash.StartsWith("A") desc, ?sorting=(PasswordHash > "X") desc and similar expression payloads now return HTTP 400 with a generic "Your request is not valid!" body — the specific reason is logged on the server, not echoed to the client, so an attacker can't probe what shape is allowed

  A built-in version of this guard is going into the framework so future releases ship the same protection out of the box without any host-side code. Plain property sorting by sensitive columns (e.g. ?sorting=PasswordHash) is a separate hardening layer — the right place to address that is a DTO-property allow-list, and we're tracking it as a follow-up to this fix.

  About the __tenant header pivot and the missing per-IP rate limit on these endpoints: the rate-limit policy on Account.SendPasswordResetCode does exist but partitions by email, so it doesn't apply here. We don't ship a built-in per-IP throttle for list endpoints because the right threshold depends on your deployment — ASP.NET Core's RateLimiter middleware scoped to /api/identity/* (or a rule at your reverse proxy / ingress) is the standard place for that.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel